Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 406 of 1013.
- CVE-2026-72917 AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization
- CVE-2026-72916 Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Addresses
- CVE-2026-72915 Mastodon: Personally-identifying information disclosure due to incorrect access control validation
- CVE-2026-72914 Mastodon: Exhausting data by an unauthenticated request to the admin retention API
- CVE-2026-72913 Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences
- CVE-2026-72912 CyberChef’s pretty-recipe parser vulnerable to client-side ReDoS / CPU exhaustion when parsing a malformed #recipe= URL
- CVE-2026-72911 ERPNext: Possibility of server-side template injection due to missing validation
- CVE-2026-72910 ERPNext: Unauthorised modification of master data due to missing validation
- CVE-2026-7291 o2oa URL Fetching FileAction.java FileAction server-side request forgery
- CVE-2026-72909 ERPNext: Broken Access Control on certain endpoints
- CVE-2026-72908 ERPNext: Possibility of SQL injection due to missing validation
- CVE-2026-72907 ERPNext: Broken Access Control on certain endpoint
- CVE-2026-72906 ERPNext: Unauthorised triggering of automated emails due to missing validation
- CVE-2026-72904 Firecrawl: Arbitrary file read via JSON Schema $ref expansion
- CVE-2026-72903 Tabby: Windows SFTP path traversal allows a malicious server to write files outside the selected download directory
- CVE-2026-72902 Dokploy: Authenticated RCE via Command Injection in registry.testRegistry / registry.testRegistryById
- CVE-2026-72901 Dokploy: Remote Code Execution via volume-backup
- CVE-2026-72900 Metabase information exposure
- CVE-2026-7290 JeecgBoot loadDict Endpoint SqlInjectionUtil.java SqlInjectionUtil sql injection
- CVE-2026-72899 Metabase SQL injection via public card or dashboard
- CVE-2026-72898 Metabase SQL Injection
- CVE-2026-72897 Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake
- CVE-2026-72895 Security feature bypass in SIMATIC IPC BX-21A
- CVE-2026-7289 D-Link DIR-825M formWanConfigSetup sub_414BA8 buffer overflow
- CVE-2026-72889 Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify
- CVE-2026-72888 Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smart_require.
- CVE-2026-72887 Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in get_request_token.
- CVE-2026-72886 Privilege escalation in dokploy
- CVE-2026-72885 Dokploy: Authenticated Command Injection in Dokploy Dockerfile Builder
- CVE-2026-72884 Dokploy: Command Injection via Compose Custom Command
- CVE-2026-72883 Dokploy: WebSocket Terminal Missing Service-Level Access Control
- CVE-2026-72882 Dokploy: Authenticated blind command injection via file mounts leads to direct remote host RCE on managed servers
- CVE-2026-72881 Dokploy: Command Injection via database credentials in backup/restore commands
- CVE-2026-72880 Dokploy: Arbitrary File Write + Remote OS Command Injection via `certificatePath`
- CVE-2026-7288 D-Link DIR-825M formVpnConfigSetup sub_4151FC buffer overflow
- CVE-2026-72879 Dokploy: Command Injection via Registry Credentials in Swarm Upload
- CVE-2026-72878 Dokploy: OS Command Injection in backup/restore pipeline via unescaped user-controlled shell arguments
- CVE-2026-72877 Dokploy: Command Injection via dockerImage in buildRemoteDocker
- CVE-2026-72876 Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.*
- CVE-2026-72875 Dokploy: Remote Code Execution (RCE) via Command Injection in settings.readTraefikFile
- CVE-2026-72874 Dokploy: Command Injection via Unescaped Git URL in Clone Commands
- CVE-2026-72873 Dokploy: Cross-tenant Git provider secrets are disclosed to low-privileged service readers via `application.one`
- CVE-2026-72872 Dokploy: OS Command Injection via Bitbucket `owner`/`repository` in `git clone`
- CVE-2026-72871 Dokploy: Unauthenticated Git Provider Injection via GitHub OAuth Callback
- CVE-2026-72870 Dokploy: Command Injection via Docker Credentials in buildRemoteDocker
- CVE-2026-7287 Memory corruption in NWA1100-N firmware
- CVE-2026-72869 Dokploy: Authenticated OS command injection in backup.restoreBackupWithLogs (databaseName) leading to host RCE
- CVE-2026-72868 Dokploy: Member-role RCE as host root via destination.testConnection rclone shell injection
- CVE-2026-72867 Command injection in dokploy
- CVE-2026-72866 WebSocket Terminal Auth Bypass
- CVE-2026-72865 Dokploy: OS Command Injection via compose `composePath`
- CVE-2026-72864 Dokploy Broken Access Control on docker-container-terminal WebSocket (Member -> Root in Arbitrary Containers)
- CVE-2026-72863 Dokploy: Missing authorization in WebSocket handlers allows a low-privilege member to gain root on the Docker host
- CVE-2026-72862 Dokploy: OS Command Injection via dockerImage field in database service deployment functions → HOST RCE
- CVE-2026-72861 Appwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is Absent
- CVE-2026-72860 Server-side request forgery in 9router
- CVE-2026-72859 Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL
- CVE-2026-72857 Budibase before 3.40.0 Credential Exposure via STRING Fields
- CVE-2026-72856 Budibase before 3.40.0 Authentication Bypass via Tenant Owner Email
- CVE-2026-72855 Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST
- CVE-2026-72854 msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation
- CVE-2026-72853 Budibase before 3.40.0 SQL Injection via Oracle connector
- CVE-2026-72852 darknet Integer Overflow in Convolutional Layer Buffer Sizing Leads to Heap Buffer Overflow
- CVE-2026-72851 Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook
- CVE-2026-72850 Budibase before 3.40.0 Arbitrary File Write via Path Traversal
- CVE-2026-72849 Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF
- CVE-2026-72848 Server-side request forgery in langchain-community
- CVE-2026-72847 broot Terminal Escape Sequence Injection via Unsanitized File and Directory Names in the Tree View
- CVE-2026-72846 Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery
- CVE-2026-72844 Lean 4 Kernel Type Checking Bypass via Mismatched Structure Projections
- CVE-2026-72843 EverShop Missing Authorization on PATCH /api/customers/:id Allows Unauthenticated Account Takeover
- CVE-2026-72842 OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass
- CVE-2026-72841 luci-app-openvpn Path Traversal RCE via instance_name2
- CVE-2026-72840 OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Write
- CVE-2026-7284 Easy Elements for Elementor <= 1.4.4 - Unauthenticated Privilege Escalation via easyel_handle_register
- CVE-2026-72839 filebrowser through 2.63.16 Privilege Escalation via Signup
- CVE-2026-72838 FileBrowser before 2.63.19 Disk Exhaustion via TUS Upload
- CVE-2026-72837 File Browser before 2.63.20 Privilege Escalation via Proxy Authentication
- CVE-2026-72836 FileBrowser before 2.63.19 Case Sensitivity Authentication Bypass
- CVE-2026-72835 filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization
- CVE-2026-72834 filebrowser before 2.63.19 Permission Bypass via checksum
- CVE-2026-72833 Grav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keys
- CVE-2026-72832 Grav before 2.0.13 Stored XSS via quoted-attribute bypass
- CVE-2026-72831 Grav through 2.0.11 Authentication Bypass via Flex Objects
- CVE-2026-72830 Grav API Plugin before 1.0.13 RCE via ConfigController scope bypass
- CVE-2026-7283 SourceCodester Pharmacy Sales and Inventory System ajax.php save_expired sql injection
- CVE-2026-72829 Grav before 1.0.13 API Key Scope Bypass via UsersController
- CVE-2026-72828 Grav before 1.0.13 API Key Scope Bypass via InvitationsController
- CVE-2026-72827 Grav CMS before 2.0.13 Remote Code Execution via Twig
- CVE-2026-72826 Grav API Plugin before 1.0.13 Scope Bypass via createApiKey
- CVE-2026-72825 Grav API Plugin before 1.0.13 API-key scope cap bypass via ReportsController
- CVE-2026-72824 Grav before 1.0.13 API Key Scope Bypass via PagesController
- CVE-2026-72823 Grav before 1.0.13 API-key scope cap bypass via DemoController
- CVE-2026-72822 Grav before 1.0.13 Authentication Bypass via disable2fa
- CVE-2026-72821 Grav Form Plugin before 9.1.15 Stored XSS via Radio Toggle
- CVE-2026-72820 Grav 2.0.11 Path Traversal via Backup Profile Configuration
- CVE-2026-7282 SourceCodester Pharmacy Sales and Inventory System ajax.php delete_expired sql injection
- CVE-2026-72819 Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload
- CVE-2026-72818 NLTK TweetTokenizer URL Pattern Backtracks Catastrophically on Naked-Domain-Like Input
- CVE-2026-72817 go-chi chi 0.9.0 before 5.3.0 IP Spoofing via X-Forwarded-For